June 2015 - tor-dev - lists.torproject.org

Multithreaded crypto on Tor
by Cory Pruce 28 Jun '15

28 Jun '15

Hi! Let me start by introducing myself. My name is Cory Pruce, am an Information Technology - Information Security Master's student at Carnegie Mellon, and would like to get more involved in Tor! I have done a bit of programming in C and have a pretty substantial crypto background. I'm not in the Google summer of code but would really like to complete this project :D (see screenshot) Please let me know if anyone is currently working on this and if Nick, David, or anyone would like to give me some advice and be someone I can bounce ideas off of :-) Thanks and I hope to hear back soon! - Cory P.S. I have cloned the repo and have been looking through relay.* and cpuworker.* files. I just would like to speak with someone before I jump in :p project

1 0

Tor dev meetings schedule changes for July
by Nick Mathewson 27 Jun '15

27 Jun '15

Hello, all! Usually the Tor development team has our weekly online[1] Tor developers meetings at Wednesday 1330 UTC (==0930 EDT), and our weekly online patch workshop time at 1800 UTC (==1400 EDT). (This is for the program 'tor', not for all the other software that happens in the Tor universe) But for the first week of July, a lot of people will be in PETS[2]. And for the second week, I'll be on vacation. So here's the revised schedule. Tuesday, June 30: Patch workshop goes on as scheduled. Nick and a few others will probably be absent. Wednesday, July 1: No weekly dev meeting! Tuesday, July 7: Patch workshop goes on as scheduled. Nick will be absent; others will be back. Wednesday, July 8: Dev meeting goes on as scheduled. Nick will probably be absent, but will send in an update somehow. For the rest of the month, we'll be on a regular schedule. [1] #tor-dev on OFTC [2] https://petsymposium.org/2015/ best wishes, -- Nick

1 0

Fwd: Orbot v15.0.1 beta 3 and NetCipher update
by Nathan Freitas 26 Jun '15

26 Jun '15

----- Original message ----- From: Nathan of Guardian <nathan(a)guardianproject.info> To: guardian-dev(a)lists.mayfirst.org Subject: Orbot v15.0.1 beta 3 and NetCipher update Date: Fri, 26 Jun 2015 10:19:49 -0400 *** Orbot v15.0.1 beta 3 released *** From: https://dev.guardianproject.info/news/233 See our previous news update (https://dev.guardianproject.info/news/231) for the more data or review the changelog here: https://gitweb.torproject.org/orbot.git/tree/CHANGELOG?id=e00f830ecadbca1b0… We've pushed the release to our Google Play beta channel (https://play.google.com/apps/testing/org.torproject.android) and our /release folder here. APK: https://guardianproject.info/releases/Orbot-v15.0.1-beta-3.apk PGP Sig: https://guardianproject.info/releases/Orbot-v15.0.1-beta-3.apk.asc You can also use FDroid to subscribe to our nightlies repo here (please uninstall any other version of Orbot first): https://dev.guardianproject.info/debug/org.torproject.android/fdroid/repo *** NetCipher library updated (v1.2) *** We've also updated our NetCipher library to support the update Intent API in Orbot that supports background starting, improved status messages via broadcasts and more. NetCipher also includes clearer code for support HttpUrlConnection proxying, TLS socket hardening, and has been re-organized a bit for clarity. https://github.com/guardianproject/NetCipher The sample app shows how to use these classes: https://github.com/guardianproject/NetCipher/tree/master/sample -- Nathan of Guardian nathan(a)guardianproject.info

1 0

update obfs4proxy in deb.torproject.org
by s7r 24 Jun '15

24 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi, An update is needed in http:// deb.torproject.org/torproject.org obfs4proxy main to version 0.0.5 (we currently have 0.0.4). armel and amrhf packages for obfs4proxy would be nice too, for mobiles/tablets/raspberrys etc. Also, why do we have tor-experimental-0.2.6.x-$dist_codename and tor-nightly-0.2.6.x-$dist_codename - any difference between them? I know 'nightly master' is for latest alpha dev release, but what's the experimental used for? -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (MingW32) iQEcBAEBCAAGBQJVhzu8AAoJEIN/pSyBJlsRIXgH/1v01c0oArU6E/xyzfi4DLN6 6bLK9emfzTAimtwgIQfH1POL+GR3xqpLl5TURN0wGEdI1Sm1vBK6wg0/mnsjNJAD +yulRlfJlbjLn+H2TJ1XFsKNQudIRpstdjQ0hyrA4SmOV3V42rk6taQSdM/b+zwG 2v54+P05Th/bbq63UDKoLjbzal/sMUe+2l1lYxO1BbxiXL9JkGU5qCTnG8uM+yXK IEXCdDlZpEdmov6ueP3PdiCrhS9v5HsZ7TIGKqVuuie6Kf1yrxIgBP5rlKsdJgqI V1bnHyhs1zvME+Klw+DF8Axqb1PqPY/dV5WoIo+s++H3+phA1TSmG46ebj5WG6E= =R2Kk -----END PGP SIGNATURE-----

2 1

Re: [tor-dev] The future of GetTor
by Adam Pritchard 23 Jun '15

23 Jun '15

> > I'm currently the maintainer of GetTor [1], and together with Nima and > Sukhbir we have been talking about the future of it. If this conversation moves elsewhere, I would really like to be kept in the loop. I'm the primary maintainer of Psiphon's email auto-responder, which was initially modeled on Tor's approach. Psiphon is, obviously, also extremely interested in robust ways of making our tools available in censoring regions. (So, Satori, etc., are also interesting.) Relatedly... When doing Logjam, etc., testing on our responder I found testssl.sh[1] to be a handy tool. Used like so: ./testssl.sh --mx torproject.org CheckTLS[2] is also good for actually doing email send and receive tests. We're currently struggling a bit with just how hardcore we can be in securing our server communications. Right now Postfix is configured[3] to only connect out using TLS and only accept incoming TLS connections from servers with a verifiable cert. That seems reasonable, except... we're getting complaints that Chinese mail services don't meet those criteria, and Chinese users can't/won't/don't use Gmail/Hotmail/Yahoo. ...As an example of the sort of shared hurdles we might encounter. [1]: https://testssl.sh/ [2]: https://www.checktls.com/ [3]: https://bitbucket.org/psiphon/psiphon-circumvention-system/src/2d052db9597d… -- Adam Pritchard Psiphon Inc.

2 4

small patch to allow gcc -fno-common for better ASAN coverage
by starlight.2015q2＠binnacle.cx 23 Jun '15

23 Jun '15

Per https://code.google.com/p/address-sanitizer/wiki/Flags one benefits from compiling with -fno-common when -fsanitize=address is active The attached patch converts the single common variable to a global/extern variable. Seems a good idea to me. Have run this with no issues, but more ASAN coverage is better than less.

1 0

How bad is not having 'enable-ec_nistp_64_gcc_128' really? (OpenBSD)
by nusenu 23 Jun '15

23 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, since enable-ec_nistp_64_gcc_128 is disabled by default on OpenBSD due to compiler bugs [1] I wanted to ask how bad is it (in relay context) to ignore the usual tor log entry: > We were built to run on a 64-bit CPU, with OpenSSL 1.0.1 or later, > but with a version of OpenSSL that apparently lacks accelerated > support for the NIST P-224 and P-256 groups. Building openssl with > such support (using the enable-ec_nistp_64_gcc_128 option when > configuring it) would make ECDH much faster. Tor's changelog "highly recommends" it [2]. Can this be "translated" to something like "the relay's bandwidth usage and usefulness will be reduced" "latency will be higher" "security will be degraded due to fallback to DH-1024" ? thanks, nusenu [1] http://article.gmane.org/gmane.os.openbsd.misc/218944 [2] https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.2.5.10 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJViDmDAAoJEFv7XvVCELh0Fi0QAKF0/7eVWgL5gExyGcCugz66 9CJOaNGVdeqb8LDxH/KEW4xC+MLhqMQ/+dL7iVOZIOtCM6i4vTpD3u4ZVnFhcGfx luyX78TqXDW3riV3izBWYScYxQdeHGv3XFXQlbGi7WQYfRt0AdorchmP2xuxD7Cg zGZFk4Bggj3qnW1sd/G3JvJL0bUi7iBKrQwPTDlnK3YSGbTYpU6lS3dQqbHqNYin yrwtlNSCi9DFjbQm5g4yjvaawnmOuxf8dlm54Ltjdn2cIHsXaPqQ6kXICiukrJhE ZLfTnPBd3yngyoq9xe7bW9P4mNVkTNmAU3VqGgEq1gSUJQObXkzOKAz63z9WAqQl GBvZFtwkbdBM4pjfWaG5FjDRc+awXxP/8K/d2vF2r6KAwkbh9Fw2uhjC6yu5c6hB KtQaovd+we+Ag4vDdE6lbQPLiCbPBiFdB6qYjkWbVflYcrsYQPoCgwjaodbV7I/Y 8Kb3Lx2C8+HFLtktEh19tOk34iKVliQk7FjE2FoiKkWryRYtY5KUAfFS8hOCfBqr 2XYtWGqQ9eh14RqvBu7CuN1cKCc0EQLcr6BF9uvd6EYtKZsa5rQC+y9Bbbd65MwB qU7lLckEkG+qwzgvuyOBvGwN8JmMmTBQASsdalAUscQFbPq7wySp9tz21pu8mOje NRRdnL1/3X9KcCMLMCVk =Oa2Z -----END PGP SIGNATURE-----

4 4

Re: [tor-dev] The future of GetTor
by teor 22 Jun '15

22 Jun '15

> Date: Thu, 18 Jun 2015 19:37:07 -0300 > From: ilv <ilv(a)riseup.net> > To: tor-dev(a)lists.torproject.org > > > … > >> Is it possible to submit an app to the app stores (I am thinking Apple's restrictions, here) that would bootstrap a Tor Browser download over the Tor network? >> >> For example: >> 1. Download app >> 2. The app has various CDN links (or a way of getting them) and a some predefined bridges >> 3. The app tries the CDN links and bridges in order of reliability / expense >> 4. If the links or bridges fail, the user gets advice on how to find new, uncensored links or bridges and input them. >> 5. App downloads and verifies Tor Browser using the CDN or the Tor network >> >> In most cases, the user experience would be one-click: >> 1. Open the app >> 2. See a recommended option highlighted out of a list of working options >> 3. click download >> 4. see a progress bar >> 5. Get a verified Tor Browser >> > > Yes, the use experience that you mention is what we're looking for. > About using the Tor network... I'm not sure about it. It's like using > Tor to download Tor? Still, I'll write it down as an option. People can use the Tor network to download Tor Browser, with the aid of a bootstrapping program. (Which can be much simpler than Tor Browser itself - see below.) If people can't use the Tor network to download a file, then it's unlikely that Tor Browser will work for them. My reasoning went something like this: 1. If we can put Tor Browser in an App Store, people won't need to use an app that downloads Tor Browser 2. If an App Store doesn't allow Tor Browser, then people need an app that will download Tor Browser 3. Perhaps the App Store will allow an app that can download Tor Browser over the Tor network (this could be as simple as tor, torify, and wget executables, and a GUI frontend) teor teor2345 at gmail dot com pgp 0xABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

2 1

The future of GetTor
by ilv 22 Jun '15

22 Jun '15

Hi people, I'm currently the maintainer of GetTor [1], and together with Nima and Sukhbir we have been talking about the future of it. First, let me present you what is (roughly) the current status of GetTor: * We send links to download Tor Browser, along with its signature file. These files are stored on Dropbox. I will be working on integrate new cloud/hosting services during Summer of Privacy. * We send these links via email. I will be working on new modules to send links via chat (XMPP) and Twitter (DM) during Summer of Privacy. * We send links to download the English (US) package of Tor Browser. I will be working on support for more locales during Summer of Privacy. That is what we have now. Is not much, but it works (more info in [1]). So, what about it? Software evolves, and we think it might be the time of GetTor to go beyond its current design. Moreover, we have received valid concerns that emails could be tampered and users could get malicious versions of Tor Browser (although we have no evidence that this is happening). Right now, when you get the Tor Browser via this method is up to you to verify its integrity. With this in mind, we have been discussing about the idea of having a signed and verified distributor app (desktop), available on official channels (OSX app store, Google Chrome store, etc), which could ease the process of downloading and verifying the integrity of Tor Browser. In other words, a user should be able to download and make sure it has the right file with just a few clicks. However, we have different thoughts on how this should work: * Option 1: GetTor should work as a backend and have an API. The distributor (and even other apps) would send queries to this API asking for links. The problem with this is that if Tor Project's website is blocked, is quite possible that the API would be blocked too (e.g. gettor.torproject.org) * Option 2: The distributor is in charge of presenting various alternatives to the user and getting the files directly from the cloud/hosting services. So, the purpose of this email is to get feedback from the community, and my specific questions to you people are the following: 1) What do you think of the distributor idea? It is something you or others would want? 2) In case we develop the distributor, should the email autoresponder remain? 3) If you agree on developing the distributor, what option you think would fit better? (please suggest better options) I would really love to hear your comments about this idea, my work at Summer of Privacy might change depending on this discussion, so please feel free to express your feelings about it :) Thanks for your time! [1] https://www.torproject.org/projects/gettor.html.en [2] https://trac.torproject.org/projects/tor/wiki/org/roadmaps/GetTor --ilv

4 6

draft-grothoff-iesg-special-use-p2p-exit-00.xml
by Christian Grothoff 22 Jun '15

22 Jun '15

Dear all, Following https://datatracker.ietf.org/doc/draft-grothoff-iesg-special-use-p2p-names/ and the separation of .onion in https://tools.ietf.org/html/draft-appelbaum-dnsop-onion-tld-01 to satisfy the IETF's desire to have lots of documents, I've now split off ".exit" as well to create draft-grothoff-iesg-special-use-p2p-exit-00 I've attached the current draft to this e-mail and would appreciate any feedback you may have. Also, if you feel that this is the wrong move entirely (i.e. because you don't want to reserve .exit), please do let me know ASAP and then I won't submit the draft. Happy hacking! Christian

1 0